CVE-2026-59171 · Package
NO FIX YET · SEE WHAT TO DO
JSON-java is a Java library for reading JSON and XML. A very long numeric value in attacker-supplied input makes the parser spend super-linear CPU time converting it, which can block request-handling threads and cause denial of service.
first public Aug 1, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that pass attacker-controlled JSON or XML into JSONObject, JSONArray or XML.toJSONObject are exposed, because a long numeric literal can tie up a thread. Strict mode and keep-strings settings do not prevent the affected path. Systems that only parse trusted, internally produced JSON can skip it.
Not affected if trusted-input-only, version-outside-range
Who cares java, json-java, org.json
org.json:json in Maven or Gradle files) and note the version.20150729 and 20260522 inclusive.20260719, which limits numeric conversion length.JSON-java is a reference implementation of a JSON package in Java. From version 20150729 through 20260522, JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens before JSONObject.stringToNumber passes them to BigInteger or BigDecimal conversion without a length limit. An application that parses attacker-controlled JSON or XML through JSONObject, JSONArray, or XML.toJSONObject can spend super-linear CPU time converting a sufficiently long numeric literal, blocking request-handling threads and causing denial of service. Strict mode and keep-strings settings in JSONParserConfiguration do not prevent the affected conversion path. Version 20260719 limits numeric conversion length.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.